Security groups are much like NACLs in that they provide a virtual firewall level of protection, but this time at the instance level, rather than the network level. Security groups are associated with instances rather than subnets and control the traffic to and from your instances within your VPC. Again, only a single security group can be applied to an instance, but the same security group can be associated with multiple instances.
Unlike NACLs, which are stateless by design, security groups are stateful, which means you do not have to configure specific rules to allow returning traffic from requests. There are also other subtle differences within the rule base, so let's take a closer look at the security group tabs.
